diff options
Diffstat (limited to 'Completion/Linux/Command/_iptables')
| -rw-r--r-- | Completion/Linux/Command/_iptables | 66 |
1 files changed, 55 insertions, 11 deletions
diff --git a/Completion/Linux/Command/_iptables b/Completion/Linux/Command/_iptables index 27c801da1..892c48710 100644 --- a/Completion/Linux/Command/_iptables +++ b/Completion/Linux/Command/_iptables @@ -1,7 +1,7 @@ -#compdef iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore +#compdef iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore arptables ebtables -local curcontext="$curcontext" state line expl i ret=1 -local -a cmds rcmds ropts rules states prev args +local curcontext="$curcontext" i ret=1 +local -a state line expl cmds rcmds ropts rules states prev args case $service in iptables-save | ip6tables-save) @@ -24,12 +24,12 @@ cmds=( -P --policy -E --rename-chain -h --help -V --version ) ropts=( - -p --protocol -s --src --source -d --dst --destination -j --jump -i + -p --proto --protocol -s --src --source -d --dst --destination -j --jump -i --in-interface -o --out-interface -f --fragment -c --set-counters ) prev=( ${words[1,CURRENT-1]} ) -case ${prev[${prev[(I)-p|--protocol]}+1]}; in +case ${prev[${prev[(I)-p|--proto|--protocol]}+1]}; in tcp) args=( '--tcp-flags[match based on TCP flags in a packet]: :->tcp-flags: :->tcp-flags' @@ -92,7 +92,42 @@ while (( i=words[(ib.i.)-m|--match]+1 )) (( i<CURRENT )); do case ${words[i]}; in - ah) args+=( '--ahspi[match SPIs in AH header]:*^!:spi' ) ;; + addrtype) + args+=( + '--src-type[match if the source address is of given type]:type:->address-types' + '--dst-type[match if the destination address is of given type]:type:->address-types' + '(--limit-iface-out)--limit-iface-in[limit to interface the packet is coming in]' + '(--limit-iface-in)--limit-iface-out[limit to interface the packet is going out]' + ) + ;; + ah) + args+=( '--ahspi[match SPIs in AH header]:*^!:spi' ) + [[ $service = ip6* ]] && args+=( + '--ahlen[total length of this header]:length (octets)' + '--ahres[match if the reserved field is filled with zero]' + ) + ;; + bpf) + args+=( + '--object-pinned[pass a path to a pinned eBPF object]:path:_files' + '--bytecode[pass BPF byte code as generated by nfbpf_compile]:code' + ) + ;; + cgroup) + args+=( + '--path[match cgroup2 membership]:path:_files -W /sys/fs/cgroup' + '--cgroup[match cgroup net_cls classid]:classid' + ) + ;; + cluster) + args+=( + '--cluster-total-nodes[set number of total nodes in cluster]:number' + '--cluster-local-node[set the local node number ID]:number' + '--cluster-local-nodemask[set the local node number ID mask]:mask' + '--cluster-hash-seed[set seed value of the Jenkins hash]:value' + ) + ;; + comment) args+=( '--comment[add comment to rule]:comment' ) ;; conntrack) args+=( '--ctstate[match packet state]:state:->cfstates' @@ -160,30 +195,34 @@ _arguments -C -s \ '(-)'{-V,--version}'[print version information]' \ '(-h --help -V --version)'{-t,--table}'[specify table]:table:(filter nat mangle raw security)' \ "($rcmds $cmds)"{-A,--append}'[append rules to end of specified chain]:chain:->chains' \ + {-C,--check}'[check for the existence of a rule]' \ "($rcmds $cmds -c --set-counters)"{-D,--delete}'[delete rules from specified chain]:chain:->chains::rule number:->rulenums' \ "($rcmds $cmds)"{-I,--insert}'[insert rules before specified rule number]:chain:->chains::rule number:->rulenums' \ "($rcmds $cmds)"{-R,--replace}'[replace a rule]:chain:->chains::rule number:->rulenums' \ - "($rcmds "${(j. .)cmds:#(-Z|--zero)}" $ropts)"{-L,--list}'[list rules in selected chain]::chain:->chains' \ + "($rcmds "${(j. .)cmds:#(-Z|--zero)}" $ropts)"{-L,--list}'[list rules in selected chain]::chain:->chains:rule number:->rulenums' \ + '(-L --list -S --list-rules)'{-S,--list-rules}'[list rules in the form of options to iptables]::chain:->chains::rule number:->rulenums' \ "($rcmds $cmds $ropts)"{-F,--flush}'[flush specified chain (delete all rules)]::chain:->chains' \ "($rcmds "${(j. .)cmds:#(-L|--list)}" $ropts)"{-Z,--zero}'[zero the packet and byte counters]::chain:->chains' \ "($rcmds $cmds)"{-N,--new,--new-chain}'[create a new user-defined chain]:chain name' \ "($rcmds $cmds)"{-X,--delete-chain}'[delete a user-defined chain]:: :->user-chains' \ "($rcmds $cmds)"{-P,--policy}'[set the policy for a chain to given target]:chain:->chains:target:->targets' \ "($rcmds $cmds)"{-E,--rename-chain}'[rename a user-defined chain]:old chain:->user-chains:new chain name' \ - "($cmds -p --protocol)"{-p,--protocol}'[specify protocol of rule]:*^!:protocol:(! tcp udp icmp all)' \ - "($cmds -s --src --source)"{-s,--src,--source}'[specify source]:*^!:network:_hosts' \ - "($cmds -d --dst --destination)"{-d,--dst,--destination}'[specify destination]:*^!:network:_hosts' \ + "($cmds -p --proto --protocol)"{-p,--proto,--protocol}'[specify protocol of rule]:*^!:protocol:(! tcp udp icmp all)' \ + "($cmds -s --src --source)"{-s,--src,--source}'[specify source]:*^!:network:_sequence _hosts' \ + "($cmds -d --dst --destination)"{-d,--dst,--destination}'[specify destination]:*^!:network:_sequence _hosts' \ "($cmds -j --jump)"{-j,--jump}'[specify rule target]:target:->targets' \ "($cmds -i --in-interface)"{-i,--in-interface}'[specify interface via which packet is received]:*^!:interface:_net_interfaces' \ "($cmds -o --out-interface)"{-o,--out-interface}'[specify interface via which packet is to be sent]:*^!:interface:_net_interfaces' \ "($cmds -f --fragment)"{-f,--fragment}'[match second or further fragments only]' \ "($cmds -D --delete -c --set-counters)"{-c,--set-counters}'[initialise packet and byte counters]:packets: :bytes' \ '(-v --verbose)'{-v,--verbose}'[enable verbose output]' \ + '(-w --wait)'{-w,--wait}'[specify maximum wait to acquire xtables lock before giving up]: :_numbers -u seconds -d 1 wait' \ + '(-W --wait-interval)'{-W,--wait-interval}'[specify wait time to try to acquire xtables lock]: :_numbers -u usecs -d "1 second" wait' \ '(-n --numeric)'{-n,--numeric}'[print IP addresses and port numbers in numeric format]' \ '(-x --exact)'{-x,--exact}'[expand numbers (display exact values)]' \ '--line-numbers[print line numbers when listing]' \ '--modprobe=[specify command to load modules with]:command:_command_names -e' \ - "($cmds)*"{-m,--match}'[extended match (may load extension)]:extension:(ah conntrack dscp esp helper icmp length limit mac mark multiport owner physdev pkttype state tcp tos ttl udp unclean)' \ + "($cmds)*"{-m,--match}'[extended match (may load extension)]:extension:(addrtype ah bpf cgroup cluster comment connbytes connlabel connlimit connmark conntrack cpu dccp devgroup dscp dsr ecn esp eui64 frag hashlimit hbh helper hl icmp icmp6 iprange ipv6header ipvs length limit mac mark mh multiport nfacct osf owner physdev pkttype policy quota rateest realm recent rpfilter rt sctp set socket state statistic string tcp tcpmss time tos ttl u32 udp unclean)' \ "$args[@]" && ret=0 case "$state" in @@ -230,6 +269,11 @@ case "$state" in [[ "$state" = cf* ]] && states+=( SNAT DNAT ) _values -s , 'state' $states && return ;; + address-types) + _wanted address-types expl 'address type' compadd \ + UNSPEC UNICAST LOCAL BROADCAST ANYCAST MULTICAST \ + BLACKHOLE UNREACHABLE PROHIBIT THROW NAT XRESOLVE && ret=0 + ;; port-list) compset -P '*,' if compset -S ',*'; then |